Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe |
| Analysis ID: | 1541680 |
| MD5: | 7b5ead3041ec05071ee6b28913d72547 |
| SHA1: | 8af0a3f29aff1d0fd9ab792539ff1a1fe7a32ad2 |
| SHA256: | e999cb5dcdea4d51a6178dfda3248fdf812d90841545a5ff4bbfaeac95e31c11 |
| Tags: | exe |
 | |
Detection
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Contains capabilities to detect virtual machines
Entry point lies outside standard sections
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Classification
- System is w10x64
SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe (PID: 3180 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Trojan.Win 64.Vmprote ct.6275.24 214.exe" MD5: 7B5EAD3041EC05071EE6B28913D72547)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | File opened / queried: | Jump to behavior | ||
| Source: | File opened / queried: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtProtectVirtualMemory: | Jump to behavior | ||
| Source: | NtMapViewOfSection: | Jump to behavior | ||
| Source: | NtClose: | |||
| Source: | NtUnmapViewOfSection: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Abuse Elevation Control Mechanism | 1 Virtualization/Sandbox Evasion | 1 Credential API Hooking | 11 Security Software Discovery | Remote Services | 1 Credential API Hooking | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Abuse Elevation Control Mechanism | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | 1 System Information Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 18% | ReversingLabs | |||
| 100% | Avira | HEUR/AGEN.1313195 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1541680 |
| Start date and time: | 2024-10-25 01:35:10 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 2m 7s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 2 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe |
| Detection: | MAL |
| Classification: | mal76.evad.winEXE@1/0@0/0 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe
- VT rate limit hit for: SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.820751850746217 |
| TrID: |
|
| File name: | SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe |
| File size: | 14'430'720 bytes |
| MD5: | 7b5ead3041ec05071ee6b28913d72547 |
| SHA1: | 8af0a3f29aff1d0fd9ab792539ff1a1fe7a32ad2 |
| SHA256: | e999cb5dcdea4d51a6178dfda3248fdf812d90841545a5ff4bbfaeac95e31c11 |
| SHA512: | 205e5fa420ff14a561f54489a4ad40bbdae38b57d9c379870b7fb0a36630da2e6af1a297baaabdd7b80f0a92c05e216d00256ff24bcdb27a59003e4b826ce2ac |
| SSDEEP: | 393216:t7ScNfOWdc5SaSwgXtDwS8WzRY1p+xUnmlf:5FNfOUaSwg98j1pK |
| TLSH: | C3E622E680D921F0E4D74A50624E6BCE3190A0AA09BD7D2D3EC61C429F36EEF554DF63 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*R.f.........."....(.....|.......;.........@.............................._...........`................................ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x141093beb |
| Entrypoint Section: | .3*9 |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66DC522A [Sat Sep 7 13:16:26 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 2e50f7b4155f4071a4897d1c6c09ad6b |
| Instruction |
|---|
| pushfd |
| inc ecx |
| push esp |
| dec ecx |
| mov esp, 36924E92h |
| nop |
| rcl dword ptr [ebx], FFFFFFD8h |
| inc ecx |
| and esp, 30AA72B4h |
| dec esi |
| lea esp, dword ptr [EA390882h] |
| push dword ptr [esp+08h] |
| popfd |
| dec eax |
| mov dword ptr [esp+08h], 5918A4D1h |
| dec esp |
| mov esp, dword ptr [esp+00h] |
| call 00007F2910A8EFEBh |
| jmp far 5A8Fh : 3E46717Eh |
| adc al, 86h |
| int 44h |
| xchg eax, ecx |
| in al, dx |
| pop eax |
| xchg eax, ebx |
| push ecx |
| xchg eax, esp |
| in al, dx |
| lodsb |
| pop esp |
| jns 00007F2910B3B3C6h |
| push ds |
| movsb |
| xlatb |
| inc ecx |
| push esp |
| jne 00007F2910B3B3D2h |
| sub al, F1h |
| inc ecx |
| adc al, 76h |
| or al, 21h |
| int3 |
| xor eax, 0C77D440h |
| and dword ptr [esp+ebp*2+0B87DC64h], edi |
| loope 00007F2910B3B386h |
| test ah, al |
| pushfd |
| mov dword ptr [ecx], ecx |
| les ebp, fword ptr [esp+edi*2-1Ah] |
| retf C6B2h |
| pop edi |
| into |
| sbb dword ptr [esi-7Fh], ecx |
| and dword ptr [esp+eax*4-67636410h], edi |
| dec ecx |
| daa |
| mov eax, dword ptr [30F10C27h] |
| ret |
| xor al, 26h |
| sbb eax, 6A193E25h |
| xchg eax, edx |
| mov word ptr [esi-5Eh], fs |
| push eax |
| loop 00007F2910B3B365h |
| jns 00007F2910B3B40Ah |
| jle 00007F2910B3B375h |
| pop edi |
| adc edx, edx |
| push FFFFFFA3h |
| and byte ptr [eax+4Bh], dh |
| mov dword ptr [29785CB8h], eax |
| mov ebx, 895CB8A3h |
| cmp byte ptr [ebx-5Dh], bh |
| mov eax, 2710585Ch |
| mov dword ptr [16555CB8h], eax |
| iretd |
| xor eax, 955CA22Ch |
| pop ss |
| pop ds |
| cmc |
| sub eax, 00655CA2h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1003310 | 0x1b8 | .3*9 |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x15f0000 | 0x548 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x15eb390 | 0x3408 | .3*9 |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x15ef000 | 0x118 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x15eb250 | 0x140 | .3*9 |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x82c000 | 0x178 | .UKD |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xfd4f | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x11000 | 0x599c | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x17000 | 0xc70 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x18000 | 0xa98 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .LW: | 0x19000 | 0x81253f | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .UKD | 0x82c000 | 0xd68 | 0xe00 | a8e6280e4d8de910fbb7beae9f090f3f | False | 0.043247767857142856 | data | 0.3165684754014781 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .3*9 | 0x82d000 | 0xdc1798 | 0xdc1800 | 82ffa1bf70e3bb8720d1536464d088ae | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .reloc | 0x15ef000 | 0x118 | 0x200 | 7503c704deb8a27dc15595a62266fcdf | False | 0.3984375 | data | 2.703668346071651 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x15f0000 | 0x548 | 0x600 | 997e3689feb443a51a4bfc8997b15d95 | False | 0.404296875 | data | 3.836717191739015 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x15f00a0 | 0x320 | data | Russian | Russia | 0.43 |
| RT_MANIFEST | 0x15f03c0 | 0x188 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5892857142857143 |
| DLL | Import |
|---|---|
| RPCRT4.dll | UuidToStringA |
| KERNEL32.dll | GetModuleFileNameA |
| USER32.dll | EnumDisplaySettingsW |
| ADVAPI32.dll | RegQueryValueExA |
| SHELL32.dll | ShellExecuteExW |
| MSVCP140.dll | ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z |
| WS2_32.dll | WSAStartup |
| d3d9.dll | Direct3DCreate9 |
| VCRUNTIME140_1.dll | __CxxFrameHandler4 |
| VCRUNTIME140.dll | __C_specific_handler |
| api-ms-win-crt-stdio-l1-1-0.dll | fflush |
| api-ms-win-crt-heap-l1-1-0.dll | malloc |
| api-ms-win-crt-utility-l1-1-0.dll | srand |
| api-ms-win-crt-filesystem-l1-1-0.dll | _unlock_file |
| api-ms-win-crt-time-l1-1-0.dll | _time64 |
| api-ms-win-crt-runtime-l1-1-0.dll | _cexit |
| api-ms-win-crt-math-l1-1-0.dll | __setusermatherr |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale |
| ntdll.dll | RtlCaptureContext |
| KERNEL32.dll | GetSystemTimeAsFileTime |
| KERNEL32.dll | HeapAlloc, HeapFree, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Russian | Russia |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
| Target ID: | 0 |
| Start time: | 19:36:04 |
| Start date: | 24/10/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Vmprotect.6275.24214.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff682dd0000 |
| File size: | 14'430'720 bytes |
| MD5 hash: | 7B5EAD3041EC05071EE6B28913D72547 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
⊘No disassembly